CVE catalog
CVE-2026-7179
A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the compo
- Severity
- Medium · CVSS 4.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.17% · Oct 25, 2026
A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.file_name leads to path traversal. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project maintainer confirms this issue: "I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected." The GitHub repository mentions, that "[u]sers and contributors should migrate to binwalk v3." This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | binwalk | sid | 2.4.3+dfsg1-3 | fixed |
| Debian | binwalk | forky | 2.4.3+dfsg1-3 | fixed |
| Debian | binwalk | trixie | 2.4.3+dfsg1-2+deb13u1 | fixed |
| Debian | binwalk | bookworm | 2.3.4+dfsg1-1 | vulnerable |
| Cpe | binwalk | Not reported | Not reported | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | binwalk | source | sid | 2.4.3+dfsg1-3 | not yet assigned | Not reported | [1136010] |
| Debian | binwalk | source | forky | 2.4.3+dfsg1-3 | not yet assigned | Not reported | [1136010] |
| Debian | binwalk | source | trixie | 2.4.3+dfsg1-2+deb13u1 | not yet assigned | Not reported | [1136010] |
| Debian | binwalk | source | bookworm | (unfixed) | not yet assigned | Not reported | [1136010] |
Notes
[bookworm] binwalk: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [binwalk]Affected
Details (2)
2.3.4+dfsg1-1· all · bookwormAffected
nvd · binwalk · debian · bookworm; nvd · binwalk · debian · 12
2.3.4+dfsg1-1· all · bookwormAffected
nvd · binwalk · debian · bookworm; nvd · binwalk · debian · 12
- [python3-binwalk]Affected
Source package: [binwalk]
Details (2)
2.3.4+dfsg1-1· all · bookwormAffected
nvd · binwalk · debian · bookworm; nvd · binwalk · debian · 12
2.3.4+dfsg1-1· all · bookwormAffected
nvd · binwalk · debian · bookworm; nvd · binwalk · debian · 12
[Debian 13 (Trixie)]
- [binwalk]Affected
Details (2)
2.4.3+dfsg1-2· all · trixieAffected · Fixed:
2.4.3+dfsg1-2+deb13u1nvd · binwalk · debian · 13
2.4.3+dfsg1-2· all · trixieAffected · Fixed:
2.4.3+dfsg1-2+deb13u1nvd · binwalk · debian · 13
- [python3-binwalk]Affected
Source package: [binwalk]
Details (2)
2.4.3+dfsg1-2· all · trixieAffected · Fixed:
2.4.3+dfsg1-2+deb13u1nvd · binwalk · debian · 13
2.4.3+dfsg1-2· all · trixieAffected · Fixed:
2.4.3+dfsg1-2+deb13u1nvd · binwalk · debian · 13
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-7179]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-7179]
- [https://security-tracker.debian.org/tracker/CVE-2026-7179]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7179.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]